Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and     Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when     processing security constraints. By adding a URL path parameter with special encodings, an attacker may be     able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the     handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters     in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by     getPathInfo() as part of the process of mapping requests to security constraints. In this particular     attack, different character encodings used in path parameters allows secured Spring MVC static resource     URLs to be bypassed. (CVE-2018-1199)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and
    Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when
    processing security constraints. By adding a URL path parameter with special encodings, an attacker may be
    able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the
    handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters
    in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by
    getPathInfo() as part of the process of mapping requests to security constraints. In this particular
    attack, different character encodings used in path parameters allows secured Spring MVC static resource
    URLs to be bypassed. (CVE-2018-1199)

ID	Name	Product	Family	Type	Severity
255491	Linux Distros Unpatched Vulnerability : CVE-2018-1199	Nessus	Misc.	Local	medium
421993	SCA: security update for org.springframework.security:spring-security-core, org.springframework:spring-core (GHSA-v596-fwhq-8x48)	Tenable Cloud Security	SCA Checks	Local	medium
421993	SCA: security update for org.springframework.security:spring-security-core, org.springframework:spring-core (GHSA-v596-fwhq-8x48)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2018-1199

medium

Tenable Plugins

medium

medium

medium